kernel: convert css_set.refcount from atomic_t to refcount_t

refcount_t type and corresponding API should be
used instead of atomic_t when the variable is used as
a reference counter. This allows to avoid accidental
refcounter overflows that might lead to use-after-free
situations.

Signed-off-by: Elena Reshetova <elena.reshetova@intel.com>
Signed-off-by: Hans Liljestrand <ishkamiel@gmail.com>
Signed-off-by: Kees Cook <keescook@chromium.org>
Signed-off-by: David Windsor <dwindsor@gmail.com>
Signed-off-by: Tejun Heo <tj@kernel.org>

1 files changed, 3 insertions, 3 deletions

diff --git a/kernel/cgroup/cgroup.c b/kernel/cgroup/cgroup.c
index 8ee78688e36d..b1cc1c306668 100644
--- a/kernel/cgroup/cgroup.c
+++ b/kernel/cgroup/cgroup.c
@@ -554,7 +554,7 @@ EXPORT_SYMBOL_GPL(of_css);
  * haven't been created.
  */
 struct css_set init_css_set = {
-        .refcount               = ATOMIC_INIT(1),
+        .refcount               = REFCOUNT_INIT(1),
         .tasks                  = LIST_HEAD_INIT(init_css_set.tasks),
         .mg_tasks               = LIST_HEAD_INIT(init_css_set.mg_tasks),
         .task_iters             = LIST_HEAD_INIT(init_css_set.task_iters),
@@ -724,7 +724,7 @@ void put_css_set_locked(struct css_set *cset)
 
         lockdep_assert_held(&css_set_lock);
 
-        if (!atomic_dec_and_test(&cset->refcount))
+        if (!refcount_dec_and_test(&cset->refcount))
                 return;
 
         /* This css_set is dead. unlink it and release cgroup and css refs */
@@ -977,7 +977,7 @@ static struct css_set *find_css_set(struct css_set *old_cset,
                 return NULL;
         }
 
-        atomic_set(&cset->refcount, 1);
+        refcount_set(&cset->refcount, 1);
         INIT_LIST_HEAD(&cset->tasks);
         INIT_LIST_HEAD(&cset->mg_tasks);
         INIT_LIST_HEAD(&cset->task_iters);